Techniques for protecting data in a processor are provided. An example method according to these techniques includes performing one or more operations on encrypted data using one or more functional units of a data path of the processor to generate an encrypted result. Performing the one or more operations includes: receiving at least one encrypted parameter pair at a functional unit, each encrypted parameter pair comprising an encrypted parameter value and a challenge value associated with the encrypted parameter value, the encrypted parameter being encrypted using a homomorphic encryption technique, the challenge value being used to recover a key used to encrypt the encrypted parameter value, and performing a mathematical computation on the at least one encrypted parameter. The method also includes outputting the encrypted result.
Legal claims defining the scope of protection, as filed with the USPTO.
1. A method for protecting data in a processor, the method comprising: performing one or more operations on encrypted data using one or more functional units of a data path of the processor to generate an encrypted result, wherein each functional unit is configured to perform a mathematical computation on at least one encrypted parameter value, to maintain data used to perform or generated by the mathematical computation in an encrypted state, and to generate an intermediate encrypted result, wherein performing the one or more operations comprises receiving at least one encrypted parameter pair at a functional unit, each encrypted parameter pair comprising an encrypted parameter value and a challenge value associated with the encrypted parameter value, the encrypted parameter value being encrypted using a homomorphic encryption technique, the challenge value being used to recover a key used to encrypt the encrypted parameter value, and performing the mathematical computation on at least one encrypted parameter value of the at least one encrypted parameter pair using the functional unit; and outputting the encrypted result.
2. The method of claim 1 , wherein the challenge value is used to recover the key used to encrypt the encrypted parameter value from a physically unclonable function (PUF).
3. The method of claim 2 , further comprising: encrypting an unencrypted parameter value to generate the encrypted parameter value of the encrypted parameter pair using a response value obtained from the PUF responsive to providing the challenge value of the encrypted parameter pair to the PUF.
4. The method of claim 3 , wherein encrypting the unencrypted parameter value to generate the encrypted parameter value of the encrypted parameter pair using the response value obtained from the PUF comprises applying an exclusive or (XOR) operation to the unencrypted parameter value and the response value obtained from the PUF responsive to providing the challenge value to the PUF.
5. The method of claim 2 , wherein performing the mathematical computation on the at least one encrypted parameter value further comprises: performing a respective mathematical computation on the at least one encrypted parameter value to generate the intermediate encrypted result from the functional unit, wherein the intermediate encrypted result is output as the encrypted result or is provided as a parameter to another functional unit.
6. The method of claim 5 , further comprising: accessing a second challenge value associated with the intermediate encrypted result; and providing the second challenge value associated with the intermediate encrypted result to the PUF to obtain the key associated with the intermediate encrypted result.
7. The method of claim 6 , further comprising: encrypting the intermediate encrypted result using the key associated with the intermediate encrypted result.
8. The method of claim 7 , further comprising: accessing a third challenge value associated with each of the at least one encrypted parameter value to obtain an encryption key associated with each respective one of the at least one encrypted parameter value; applying the encryption key associated with each respective one of the at least one encrypted parameter value to the intermediate encrypted result to remove encryption associated with the at least one encrypted parameter value, wherein the intermediate encrypted result remains encrypted using the key associated with the intermediate encrypted result.
9. The method of claim 1 , wherein outputting the encrypted result comprises outputting an encrypted result value and the challenge value associated with the encrypted result value.
10. The method of claim 9 , further comprising: providing the challenge value associated with the encrypted result value to obtain a response value from the PUF; and decrypting the encrypted result value using the response value obtained from the PUF.
11. The method of claim 10 , wherein decrypting the encrypted result value using the response value from the PUF comprises applying an exclusive or (XOR) operation to the encrypted result value and the response value obtained from the PUF responsive to providing the challenge value to the PUF.
12. The method of claim 9 , further comprising: storing the encrypted result value and the challenge value associated with the encrypted result value in a memory associated with the processor.
13. An apparatus comprising: means for receiving at least one encrypted parameter pair at a functional unit, each encrypted parameter pair comprising an encrypted parameter value and a challenge value associated with the encrypted parameter value, the encrypted parameter value being encrypted using a homomorphic encryption technique, the challenge value being used to recover a key used to encrypt the encrypted parameter value, wherein the functional unit is configured to perform a mathematical computation on at least one encrypted parameter value and to generate an intermediate encrypted result; means for performing a mathematical computation on at least one encrypted parameter value of the at least one encrypted parameter pair using the functional unit, wherein the means for performing the mathematical computation on the at least one encrypted parameter comprises means for maintaining data used to perform or generated by the mathematical computation in an encrypted from and means for outputting an intermediate encrypted result; and means for outputting an encrypted result based at least in part on the intermediate encrypted result.
14. The apparatus of claim 13 , wherein the challenge value is used to recover the key used to encrypt the encrypted parameter value from a physically unclonable function (PUF).
15. The apparatus of claim 14 , further comprising: means for encrypting an unencrypted parameter value to generate the encrypted parameter value of the encrypted parameter pair using a response value obtained from the PUF responsive to providing the challenge value of the encrypted parameter pair to the PUF.
16. The apparatus of claim 15 , wherein the means for encrypting the unencrypted parameter value to generate the encrypted parameter value of the encrypted parameter pair using the response value obtained from the PUF comprises means for applying an exclusive or (XOR) operation to the unencrypted parameter value and the response value obtained from the PUF responsive to providing the challenge value to the PUF.
17. The apparatus of claim 14 , wherein the means for performing the mathematical computation on the at least one encrypted parameter value further comprises: means for performing a respective mathematical computation on the at least one encrypted parameter value to generate the intermediate encrypted result from the functional unit, wherein the intermediate encrypted result is output as the encrypted result or is provided as a parameter to another functional unit.
18. The apparatus of claim 17 , further comprising: means for accessing a second challenge value associated with the intermediate encrypted result; and means for providing the challenge value associated with the intermediate encrypted result to the PUF to obtain an encryption key associated with the intermediate encrypted result.
19. The apparatus of claim 18 , further comprising: means for encrypting the intermediate encrypted result using the encryption key associated with the intermediate encrypted result.
20. The apparatus of claim 19 , further comprising: means for accessing a third challenge value associated with each of the at least one encrypted parameter value to obtain an encryption key associated with each respective one of the at least one encrypted parameter value; means for applying the encryption key associated with each respective one of the at least one encrypted parameter value to the intermediate encrypted result to remove encryption associated with the at least one encrypted parameter value, wherein the intermediate encrypted result remains encrypted using the key associated with the intermediate encrypted result.
21. The apparatus of claim 13 , wherein the means for outputting the encrypted result comprises means for outputting an encrypted result value and the challenge value associated with the encrypted result value.
22. A processor comprising: a memory encryption device configured to encrypt data using a homomorphic encryption technique; a data path comprising one or more functional units, the one or more functional units each being configured to perform a mathematical computation on at least one encrypted parameter value, to maintain data used to perform or generated by the mathematical computation in an encrypted state, and to generate an encrypted result, the one or more functional units being configured to receive at least one encrypted parameter pair, each encrypted parameter pair comprising an encrypted parameter value and a challenge value associated with the encrypted parameter value, the encrypted parameter value being encrypted using the homomorphic encryption technique, the challenge value being used to recover a key used to encrypt the encrypted parameter value, the one or more functional units being further configured to perform a mathematical computation on at least one encrypted parameter value of the at least one encrypted parameter pair, the data path being configured to output an encrypted result from the one or more functional units of the data path.
23. The processor of claim 22 , wherein the challenge value is used to recover the key used to encrypt the encrypted parameter value from a physically unclonable function (PUF).
24. The processor of claim 23 , wherein a respective one of the one or more functional units is configured to: encrypt an unencrypted parameter value to generate the encrypted parameter value of the encrypted parameter pair using a response value obtained from the PUF responsive to providing the challenge value of the encrypted parameter pair to the PUF.
25. The processor of claim 24 , wherein the respective one of the one or more functional units being configured to encrypt the unencrypted parameter value to generate the encrypted parameter value of the encrypted parameter pair using the response value obtained from the PUF is further configured to apply an exclusive or (XOR) operation to the unencrypted parameter value and the response value obtained from the PUF responsive to providing the challenge value to the PUF.
26. The processor of claim 23 , wherein the respective one of the one or more functional units is configured to: perform a respective mathematical computation on the at least one encrypted parameter value to generate the intermediate encrypted result from the respective one of the one or more functional units, wherein the intermediate encrypted result is output as the encrypted result or is provided as a parameter to another functional unit.
27. The processor of claim 26 , wherein the respective one of the one or more functional units is configured to: access a second challenge value associated with the intermediate encrypted result; and provide the challenge value associated with the intermediate encrypted result to the PUF to obtain an encryption key associated with the intermediate encrypted result.
28. The processor of claim 27 , wherein the respective one of the one or more functional units is configured to: encrypt the intermediate encrypted result using the key associated with the intermediate encrypted result.
29. A non-transitory, computer-readable medium, having stored thereon computer-readable instructions for protecting data in a memory, comprising instructions configured to cause a computer to: receive at least one encrypted parameter pair at a functional unit, each encrypted parameter pair comprising an encrypted parameter value and a challenge value associated with the encrypted parameter value, the encrypted parameter value being encrypted using a homomorphic encryption technique, the challenge value being used to recover a key used to encrypt the encrypted parameter value, wherein the functional unit is configured to perform a mathematical computation on at least one encrypted parameter value; perform a mathematical computation on at least one encrypted parameter value of the at least one encrypted parameter pair using the functional unit, wherein the functional unit is configured to perform a mathematical computation on at least one encrypted parameter value, to maintain data used to perform or generated by the mathematical computation in an encrypted state, and to generate an intermediate encrypted result; and output an encrypted result based at least in part on the intermediate encrypted result.
30. The non-transitory, computer-readable medium of claim 29 , wherein the challenge value is used to recover the key used to encrypt the encrypted parameter value from a physically unclonable function (PUF).
Cooperative Patent Classification codes for this invention. Click any code to explore related patents in that topic.
June 12, 2015
September 12, 2017
Browse 5M+ US patents with plain-English claim translations and AI-generated analysis.